fix: replace wildcard CORS and hardcoded SECRET_KEY in WebSocket servers#4028

Closed

BossChaos wants to merge 7 commits intoScottcjn:mainfrom

BossChaos:fix/wildcard-cors-weak-secrets

Commits on May 7, 2026

fix: add input validation to prevent DoS via type conversion errors (#2687)
BossChaos
committed
fix: add lock to _process_block prevent race condition wallet mutation (#71)
BossChaos
committed
fix: add file upload validation (type check, size limit, path traversal)
BossChaos
committed
fix: replace pickle with json to prevent deserialization RCE vulnerability
BossChaos
committed
fix: add hmac.compare_digest to remaining timing-vulnerable admin key comparisons
BossChaos
committed
fix: add input validation to UTXO transfer (amount, fee, address checks)
BossChaos
committed
fix: replace wildcard CORS and hardcoded SECRET_KEY in WebSocket servers
BossChaos
committed